A slightly rhetorical question I guess, but I have been trying to get wsHttpBinding to work for my application, and although it does work perfectly if I am able to physically import the required keys onto a client machine (which is clearly not feasible for a publicly available application), trying to deploy those certificates programmatically is proving extremely difficult. Not only that, but it has a weak point in that the private key password must be in the certificate installation application anyway - theoretically rendering the secure WCF link useless anyway.

I am now at the point where I am considering simply using basicHttpBinding, but encrypting the limited amount of data I am sending using the server's public key (file based using CryptoSys PKI). Does basicHttpBinding leave me open to any other kind of risk? I only use the server connectivity to service activation requests - after that, no other contact is necessary.

I've not noticed any other applications installing certificates onto my machine in order to service activation requests - e.g. Kaspersky must securely contact it's activation server - but there are no obvious certificates in the store.

  • If you are only sending data from the client to the server, you may be able get by with encrypting with the server's public key. But you'll not be able to do the same for communication in the reverse direction. Also, public/private key encryption is slow. The big problem with this is that you are sort of rewriting SSL. Generally it's better to use existing crypto than writing your own. – Neil Smithline Sep 6 '15 at 20:25
  • Thank you. Yes, agreed, it is reinventing the wheel to an extent. I think much of my issues have been caused because I have not been paying for industry signed keys which I could then use to sign my own client/server keys. I do have an SSL key for the website itself, but cannot sign anything else with it to my knowledge. I may revisit the security once I've cleared up other things - but just need to press ahead with the functional side of the application now. – John W Sep 6 '15 at 21:43
  • I should add that I am able to do everything I need regarding the application by simply signing data on the server, and then on the client, validating that signed data, and recovering a few extra bytes of data that I injected into the encoded data before signing. So just having the private key on the server side does work for me. – John W Sep 6 '15 at 21:47
  • Nobody seems to be helping and I don't know WCF. Perhaps you would do better on a the WCF forum – Neil Smithline Sep 10 '15 at 3:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.